add multicluster access provider options to Helm chart

Signed-off-by: kahirokunn <okinakahiro@gmail.com>

Author: kahirokunn

config/charts/knative-operator/templates/credential-providers-config.yaml

@@ -0,0 +1,41 @@
+# Copyright 2025 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- $mc := .Values.knative_operator.multicluster | default dict }}
+{{- if $mc.enabled }}
+{{- $mountPaths := list }}
+{{- range ($mc.plugins | default (list)) }}
+{{-   $mountPaths = append $mountPaths .mountPath }}
+{{- end }}
+{{- $cfg := $mc.accessProvidersConfig | default dict }}
+{{- range ($cfg.providers | default (list)) }}
+{{-   $cmd := (.execConfig | default dict).command | default "" }}
+{{-   if $cmd }}
+{{-     $cmdDir := dir $cmd }}
+{{-     if not (has $cmdDir $mountPaths) }}
+{{-       fail (printf "multicluster validation error: provider %q command %q has parent dir %q which does not match any plugins[].mountPath (have %v); execConfig.command parent directory must equal a plugin mountPath" .name $cmd $cmdDir $mountPaths) }}
+{{-     end }}
+{{-   end }}
+{{- end }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: clusterprofile-provider-file
+  namespace: "{{ .Release.Namespace }}"
+  labels:
+    app.kubernetes.io/name: knative-operator
+    app.kubernetes.io/version: "{{ .Chart.Version }}"
+data:
+  config.json: {{ $mc.accessProvidersConfig | default dict | mustToJson | quote }}
+{{- end }}

config/charts/knative-operator/templates/operator.yaml

@@ -855,5 +855,31 @@ spec:
           ports:
             - name: metrics
               containerPort: 9090
+{{- $mc := .Values.knative_operator.multicluster | default dict }}
+{{- if $mc.enabled }}
+          args:
+            - --clusterprofile-provider-file=/etc/cluster-inventory/config.json
+          volumeMounts:
+            - name: cred-config
+              mountPath: /etc/cluster-inventory
+              readOnly: true
+{{- range ($mc.plugins | default list) }}
+            - name: {{ .name }}
+              mountPath: {{ .mountPath }}
+              readOnly: true
+{{- end }}
+{{- end }}
+{{- $mc := .Values.knative_operator.multicluster | default dict }}
+{{- if $mc.enabled }}
+      volumes:
+        - name: cred-config
+          configMap:
+            name: clusterprofile-provider-file
+{{- range ($mc.plugins | default list) }}
+        - name: {{ .name }}
+          image:
+            reference: {{ .image }}
+{{- end }}
+{{- end }}
 
 ---

config/charts/knative-operator/templates/rbac/eventing-operator-role.yaml

@@ -401,3 +401,12 @@ rules:
       - list
       - get
       - watch
+  # for multicluster support
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - clusterprofiles
+    verbs:
+      - get
+      - list
+      - watch

config/charts/knative-operator/templates/rbac/serving-operator-role.yaml

@@ -252,6 +252,15 @@ rules:
       - pods
     verbs:
       - get
+  # for multicluster support
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - clusterprofiles
+    verbs:
+      - get
+      - list
+      - watch
 # Copyright 2020 The Knative Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

config/charts/knative-operator/values.yaml

@@ -1,4 +1,23 @@
 knative_operator:
+  # Multi-cluster (Cluster Inventory API): when enabled, the chart mounts
+  # access provider config and optional plugin images, and sets
+  # --clusterprofile-provider-file on the operator. ClusterProfile.status
+  # accessProviders are not managed by this chart.
+  multicluster:
+    enabled: false
+    accessProvidersConfig: {}
+    plugins: []
+    # accessProvidersConfig:
+    #   providers:
+    #     - name: token-secretreader
+    #       execConfig:
+    #         apiVersion: client.authentication.k8s.io/v1
+    #         command: /credential-plugins/token-secretreader/kubeconfig-secretreader-plugin
+    #         provideClusterInfo: true
+    # plugins:
+    #   - name: token-secretreader
+    #     image: ghcr.io/example/plugin:v1.0.0
+    #     mountPath: /credential-plugins/token-secretreader
   knative_operator:
     image: gcr.io/knative-releases/knative.dev/operator/cmd/operator
     tag: {{ tag }}

docs/release.md

@@ -85,7 +85,7 @@ spec:
             ...
             - name: KUBERNETES_MIN_VERSION
               value: "{{ .Values.knative_operator.kubernetes_min_version }}"
-            ...      
+            ...
 ```
 
 and
@@ -106,7 +106,7 @@ spec:
             ...
             - name: KUBERNETES_MIN_VERSION
               value: "{{ .Values.knative_operator.kubernetes_min_version }}"
-            ...      
+            ...
 ```
 
 You need to remove the line containing `logging.request-log-template:`, because the value of this key contains `{{ }}` in the example,
@@ -128,3 +128,8 @@ helm install knative-operator ./knative-operator-{version}.tgz
 ```
 
 Replace `{version}` with the correct version for your artifact.
+
+For multi-cluster installs using `spec.clusterProfileRef` on `KnativeServing` / `KnativeEventing`, set
+`knative_operator.multicluster.enabled` to `true` in `values.yaml` and provide
+`knative_operator.multicluster.accessProvidersConfig` (structured YAML; rendered to the operator's `config.json`) and
+`knative_operator.multicluster.plugins` (image volume mounts for exec plugins).